You should not use query strings when you are passing hidden information and when you are passing large chunks of data.
A query string is not hidden in any way because it will always appear in the address bar of a browser. This means passing the password from one page to a page with a query string is a bad idea.
Also, query strings are not a very good choice for passing large amounts of data. For example, IE 4.0 can’t handle a query string that is larger than about 2,000 characters.
